Caddy: /logout on every gated host redirects to Authentik sign-out

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

README.md

@@ -275,7 +275,8 @@ Design: **Authentik authenticates once for the whole domain; Caddy authorizes pe
    copyparty additionally requires a header with a secret name that only Caddy adds (`idp-h-key`,
    `COPYPARTY_IDP_KEY` in `.env`), so identity headers cannot be forged even if copyparty were reached directly.
    Logout: copyparty's logout link, the live portal's "Sign out" and the dock's "sign out" go through
-   `/outpost.goauthentik.io/sign_out`. Set the provider's **Invalidation flow** to
+   `/outpost.goauthentik.io/sign_out`; `https://<any gated host>/logout` does the same from anywhere
+   (e.g. from the Syncthing UI, which has no logout of its own). Set the provider's **Invalidation flow** to
    `default-provider-invalidation-flow` so that also ends the Authentik login: every logout then forces a full
    Discord re-login on the next visit (and picks up group changes). Discord itself may approve silently if
    you are still logged into Discord in that browser.